Policy enforcement for bare metal servers by top of rack switches

Abstract

A plurality of switches may be arranged according to a spine and leaf topology in which each spine switch is connected to all leaf switches. A leaf switch includes a memory configured to store a plurality of policies, each of the plurality of policies being associated with a respective source identifier value and a respective destination address; a network interface communicatively coupled to one of the spine switches; and a processor implemented in circuitry and configured to: receive a packet from the spine switch via the network interface, the packet being encapsulated with a Virtual Extensible Local Area Network (VXLAN) header; extract a source identifier value from the VXLAN header; determine a destination address for the packet; determine a policy of the plurality of policies to apply to the packet according to the source identifier value and the destination address; and apply the policy to the packet.

What is claimed is: 
     
         1 . A method comprising:
 receiving, by a leaf switch of a plurality of switches arranged according to a spine and leaf topology, a packet from a spine switch of the plurality of switches, the packet being encapsulated with a Virtual Extensible Local Area Network (VXLAN) header;   extracting, by the leaf switch, a source identifier value from the VXLAN header;   determining, by the leaf switch, a destination address for the packet;   determining, by the leaf switch, a policy to apply to the packet according to the source identifier value and the destination address; and   applying, by the leaf switch, the policy to the packet.   
     
     
         2 . The method of  claim 1 , further comprising storing, by the leaf switch, a plurality of policies, including the determined policy, in ternary content-addressable memory (TCAM) of the leaf switch, each of the plurality of policies being associated with a respective source identifier value and a respective destination address. 
     
     
         3 . The method of  claim 1 , further comprising receiving, by the leaf switch, data defining a plurality of policies, including the determined policy, from a controller device for the plurality of switches, each of the plurality of policies being associated with a respective source identifier value and a respective destination address. 
     
     
         4 . The method of  claim 1 , wherein extracting the source identifier value from the VXLAN header comprises:
 parsing eight flag bits of the VXLAN header;   extracting the source identifier value from bits of the VXLAN header following the eight flag bits; and   parsing a VXLAN Network Identifier (VNI) value from bits of the VXLAN header following the source identifier value.   
     
     
         5 . The method of  claim 1 , wherein extracting the source identifier value from the VXLAN header comprises:
 parsing eight flag bits of the VXLAN header;   parsing reserved bits of the VXLAN header following the eight flag bits;   parsing a VXLAN Network Identifier (VNI) value from bits of the VXLAN header following the reserved bits; and   extracting the source identifier value from bits of the VXLAN header following the VNI value.   
     
     
         6 . The method of  claim 1 , wherein the source identifier value represents a category for a source application that generated the packet. 
     
     
         7 . The method of  claim 1 , wherein the packet comprises a first packet, wherein the spine switch comprises a first spine switch, wherein the VXLAN header comprises a first VXLAN header, and wherein the source identifier value comprises a first source identifier value, the method further comprising:
 receiving, by the leaf switch, data mapping a plurality of hardware source ports to a second source identifier value from a controller device for the plurality of switches;   receiving, by the leaf switch, a second packet from the network device separate from the plurality of switches, the second packet being different than the first packet;   determining, by the leaf switch, a hardware source port of the leaf switch by which the second packet was received;   using, by the leaf switch, the data mapping the plurality of source ports to the second source identifier value to determine that the source port is mapped to the second source identifier value;   adding, by the leaf switch, the second source identifier value to a second VXLAN header for the second packet; and   forwarding, by the leaf switch, the second packet including the second source identifier value to a second spine switch of the plurality of switches.   
     
     
         8 . A leaf switch device of a plurality of switches arranged according to a spine and leaf topology, the leaf switch device comprising:
 a memory configured to store a plurality of policies, each of the plurality of policies being associated with a respective source identifier value and a respective destination address;   a network interface communicatively coupled to a spine switch of the plurality of switches; and   a processor implemented in circuitry and configured to:
 receive a packet from the spine switch via the network interface, the packet being encapsulated with a Virtual Extensible Local Area Network (VXLAN) header; 
 extract a source identifier value from the VXLAN header; 
 determine a destination address for the packet; 
 determine a policy of the plurality of policies to apply to the packet according to the source identifier value and the destination address; and 
 apply the policy to the packet. 
   
     
     
         9 . The leaf switch device of  claim 8 , wherein the memory comprises ternary content-addressable memory (TCAM). 
     
     
         10 . The leaf switch device of  claim 8 , wherein the processor is further configured to receive data defining the plurality of policies from a controller device for the plurality of switches. 
     
     
         11 . The leaf switch device of  claim 8 , wherein to extract the source identifier value from the VXLAN header, the processor is configured to:
 parse eight flag bits of the VXLAN header;   extract the source identifier value from bits of the VXLAN header following the eight flag bits; and   parse a VXLAN Network Identifier (VNI) value from bits of the VXLAN header following the source identifier value.   
     
     
         12 . The leaf switch device of  claim 8 , wherein to extract the source identifier value from the VXLAN header, the processor is configured to:
 parse eight flag bits of the VXLAN header;   parse reserved bits of the VXLAN header following the eight flag bits;   parse a VXLAN Network Identifier (VNI) value from bits of the VXLAN header following the reserved bits; and   extract the source identifier value from bits of the VXLAN header following the VNI value.   
     
     
         13 . The leaf switch device of  claim 8 , wherein the source identifier value represents a category for a source application that generated the packet. 
     
     
         14 . The leaf switch device of  claim 8 , wherein the packet comprises a first packet, wherein the spine switch comprises a first spine switch, wherein the VXLAN header comprises a first VXLAN header, wherein the source identifier value comprises a first source identifier value, and wherein the processor is further configured to:
 receive data mapping a plurality of source ports to a second source identifier value from a controller device for the plurality of switches;   receive a second packet from the network device separate from the plurality of switches, the second packet being different than the first packet;   determine a hardware source port of the leaf switch by which the second packet was received;   use the data mapping the plurality of source ports to the second source identifier value to determine that the source port is mapped to the second source identifier value;   add the second source identifier value to a second VXLAN header for the second packet; and   forward the second packet including the second source identifier value to a second spine switch of the plurality of switches.   
     
     
         15 . A non-transitory computer-readable storage medium comprising instructions that, when executed, cause a processor of a leaf switch device of a plurality of switches arranged according to a spine and leaf topology to:
 receive a packet from a spine switch of the plurality of switches, the packet being encapsulated with a Virtual Extensible Local Area Network (VXLAN) header;   extract a source identifier value from the VXLAN header;   determine a destination address for the packet;   determine a policy of the plurality of policies to apply to the packet according to the source identifier value and the destination address; and   apply the policy to the packet.   
     
     
         16 . The non-transitory computer-readable storage medium of  claim 15 , further comprising instructions that cause the processor to store a plurality of policies, including the determined policy, in ternary content-addressable memory (TCAM) of the leaf switch device, each of the plurality of policies being associated with a respective source identifier value and a respective destination address. 
     
     
         17 . The non-transitory computer-readable storage medium of  claim 15 , further comprising instructions that cause the processor to receive data defining the plurality of policies from a controller device for the plurality of switches. 
     
     
         18 . The non-transitory computer-readable storage medium of  claim 15 , wherein the instructions that cause the processor to extract the source identifier value from the VXLAN header comprise instructions that cause the processor to:
 parse eight flag bits of the VXLAN header;   extract the source identifier value from bits of the VXLAN header following the eight flag bits; and   parse a VXLAN Network Identifier (VNI) value from bits of the VXLAN header following the source identifier value.   
     
     
         19 . The non-transitory computer-readable storage medium of  claim 15 , wherein the instructions that cause the processor to extract the source identifier value from the VXLAN header comprise instructions that cause the processor to:
 parse eight flag bits of the VXLAN header;   parse reserved bits of the VXLAN header following the eight flag bits;   parse a VXLAN Network Identifier (VNI) value from bits of the VXLAN header following the reserved bits; and   extract the source identifier value from bits of the VXLAN header following the VNI value.   
     
     
         20 . The non-transitory computer-readable storage medium of  claim 15 , wherein the packet comprises a first packet, wherein the spine switch comprises a first spine switch, wherein the VXLAN header comprises a first VXLAN header, wherein the source identifier value comprises a first source identifier value, and wherein the processor is further configured to:
 receive data mapping a plurality of source ports to a second source identifier value from a controller device for the plurality of switches;   receive a second packet from the network device separate from the plurality of switches, the second packet being different than the first packet;   determine a hardware source port of the leaf switch by which the second packet was received;   use the data mapping the plurality of source ports to the second source identifier value to determine that the source port is mapped to the second source identifier value;   add the second source identifier value to a second VXLAN header for the second packet; and   forward the second packet including the second source identifier value to a second spine switch of the plurality of switches.